Clock synchronization in a distributed system

ABSTRACT

The present invention provides an improved clock synchronization algorithm for a distributed system intended for real time applications by performing at the same time an off-set correction and a clock read correction at each node of the distributed system. Expensive oscillators can be avoided and synchronization can be established faster and with higher precision.

CROSS REFERENCE TO RELATED APPLICATIONS

Applicants claim priority under 35 U.S.C. 119 of European ApplicationNo. 01118177.3 filed on Jul. 26, 2001. Applicants also claim priorityunder 35 U.S.C. §365 of PCT/EP02/08261 filed on Jul. 24, 2002. Theinternational application under PCT article 21(2) was published inEnglish.

The present invention relates to the synchronization of a distributedsystem for real time applications, particular to a method forsynchronizing nodes in the distributed system with a local real timeclock in each node and to a synchronizing unit included in the nodes.

A distributed system consists of a number of nodes which are looselyconnected by a communication link. Each node of the distributed realtime system contains an own local real time clock. The accuracy of theseclocks is based on the accuracy of the quarts crystal included in eachof the local clocks. A real time application which is controlled by thedistributed system requires the synchronization of the local clocks ofthe nodes. The synchronized time is generally called “global time”.

In a distributed system, a global time is an important functionality forreal time applications. Real time tasks may for instance depend onmessages from tasks of different nodes. Scheduling such tasks requirestiming information to be meaningful not only locally. A systemcomprising clocks at different nodes, however, does not necessarily showthe same time. Usually, there is an off-set between the clocks and oftenthey do not run at exactly the same frequency. Moreover, this frequencyis not constant but may depend on temperature, for instance.

Internal synchronization among nodes is to be distinguished fromexternal synchronization to a reference time source. Apart from thetraditional area of automated applications, distributed real timesystems are increasingly implemented by the car making industry.Presently, control devices in a car are connected using the CAN bussystem, in particular for controlling car engines or automatictransmissions. The number of control systems combining multiple sensors,actuators and electronic control units is significantly increased. Thecontinuing use of control systems and sensors, actuators and electroniccontrol units connected thereto place demands on thee communicationtechnology currently not addressed by existing communication protocols.In particular the introduction of automotive “by-wire” systems introduceadditional requirements for future in-car control applications whereinreliability is of particular importance. This includes a clocksynchronization service suitable for safety-critical controlapplications.

The present invention is particularly intended for use in an advancedautomotive communication system named FlexRay. The applicants aremembers of an industry consortium formed to develop and implementFlexRay technology aiming to define a standard for innovated high speedcontrol applications in a car, such as x-by-wire.

Future automotive applications demand high speed bus systems that aredeterministic and fault-tolerant and capable of supporting distributedcontrol systems. The FlexRay communication system allows synchronous andasynchronous gross data transmission at high speed data rates up to 10Mbit/s. This technology supports redundancy and fault-tolerant clocksynchronizations for a global time base.

Existing bus systems may be differentiated depending on the kind ofhandling access to the bus, namely either time multiplex, frequencymultiplex or code multiplex. In the field of real-time control systemsthere are two fundamentally different principles how to control theactivity of the system, namely time-triggered control or event-triggeredcontrol. In time-triggered systems, all activities are carried out atcertain points in time known a priori. Accordingly, all nodes intime-triggered systems have a common notion of time, based onapproximately synchronized clocks. In contrast, in the event-triggeredsystems all activities are carried out in response to relevant eventsexternal to the system. A main difference between both systems is thedeterministic behavior. Systems controlling access to the bus based onpredefined rules, guarantee that each node may exclusively access thebus within a certain time period for transmitting messages.Event-triggered systems handle access based on assigned priorities and,thus, cannot guarantee a deterministic behavior.

A distributed real time system depends on fault-tolerant clocksynchronization. This is particular true in distributed architectures inwhich nodes perform their actions according to a predetermined schedule.Such time-triggered systems are mainly used in safety-criticalapplications. Clocks synchronization is an essential element of atime-triggered architecture to function properly.

In a distributed real time system, synchronization may be realized bythe exchange of messages in order to avoid separate channels used forthe synchronization of the local clocks. The synchronization procedureitself should tolerate faulty clocks and missing messages.

The present invention is intended for time-triggered architectures beingemployed in connection with devices controlling safety-criticalelectronic systems without mechanical back-up, “by-wire” systems forsteering, braking or suspension control. High trust must be placed inits correct functioning.

Clock synchronization is the most basic service for achieving therequired real-time properties.

A known fault tolerant real-time communication system is theTime-Triggered Protocol (TTP), a communication protocol particularlysuitable for safety-critical control applications. The synchronizationalgorithm of TTP does not use special synchronization messages whichprovide the reading of a node's clock to other nodes. The delay ofarrival of incoming messages is used to estimate the value of thesender's clock. Further, TTP provides a means to collect timinginformation only from selected nodes and ignores clock values of nodesthat are known to have oscillators of inferior quality. Clocksynchronization and the corresponding time measurement are performed ona cyclic basis.

The distinguishing characteristic of time-triggered systems is that allsystem activities are initiated by the progress of time. The TTPprotocol operates cyclically. Each node is supplied with a clock and astatic schedule. The schedule determines when certain actions have to beperformed, in particular when messages of a certain type are to be sentby a particular node.

The schedule contains global information common to all nodes, such as aduration of a given slot or the identity of the sending node. As theintended system behavior is thus known to all nodes, importantinformation can be obtained indirectly from the messages.

Access to the system bus is determined by a time-division multipleaccess (TDMA) schema which is precompiled into the schedule. Every nodeowns certain slots, in which it is allowed to send messages on the bus.A complete cycle during which every nodes has had access to the bus onceis called TDMA round. After a TDMA round is completed, the same temporalaccess pattern is repeated again.

The clocks of the nodes must be synchronized tightly enough to agree onthe current slot and to scan the bus at appropriate times for messagesto arrive. To prevent a faulty node from speaking out of turn, the businterface is controlled by a “bus guardian” giving access to the busonly at appropriate times. Each node is supplied with a physical clockwhich is typically implemented by a discrete counter. The counter isincremented periodically, triggered by a crystal oscillator.

As such oscillators do not resonate with a perfectly constant frequency,the clocks drift apart from real time. It is the task of clocksynchronization to repeatedly compute an adjustment of a node's physicalclock in order to keep it in agreement with the other node's clock. Theadjusted physical clock is what is used by a node during operation.

The most simple way of clock adjustment is a one-step adaptation,wherein the current off-set to the real time is simply added to theclock. This procedure may cause consistency problems.

In another approach, the clock speed is varied to run faster or slowerin order to compensate clock deviations. The time of a clock runs fasteror more slowly until an off-set is compensated for. A positive off-setmay be compensated by the clock running more slowly and an oppositeoff-set may be compensated by the clock running more fast. However, theclock will keep on drifting and needs to be adjusted continuously.

In the TTP system the clock synchronization algorithm operates togetherestimates of readings of other node's clock to estimate an adjustmentfor the local clock. Since every node knows beforehand at which timecertain messages will be sent the difference between the time a messageis expected to be received by a node and the actual arrival time can beused to calculate the deviation between the sender's and the receiver'sclock. In this way no special synchronization messages are needed inTTP.

Clock synchronization in the TTP protocol requires crystal oscillatorswhich resonate in almost perfectly constant frequencies in order toarrive at a maximum clock deviation for each TDMA round being as smallas possible.

Starting from this prior art, it is the problem of the present inventionto further improve clock synchronization, in particular to reduce thecosts for crystal oscillators and achieving smaller maximum clockdeviations.

This is achieved by the features of claim 1 for a method ofsynchronizing nodes and by the features of claim 19 for a synchronizingunit.

The present invention avoids the use of expensive crystal oscillators byadjusting the local clock in a node by an off-set correction value and,in addition, by a clock rate correction value.

In this way, an internal clock synchronization of all clocks is achievedfaster and with higher precision. The exact rate correction protects theclocks for an increasing off-set overtime and the additional off-setcorrection decreases the existing off-set between the clocks of thenodes.

According to a preferred embodiment of the present invention, the clockrate correction is calculated based on a set of clock rate deviationsbetween the local clock of a node and other nodes.

In a first preferred embodiment, the set of clock rate deviations iscalculated from two sets of time deviations which are determined betweenthe local clock of the node and the other nodes.

In a second preferred embodiment, the set of clock rate deviations isbased on a difference between a measured time interval of receivedmessages for a particular node based on its local clock and an expectedtime interval.

Preferably, the present invention is employed in a TDMA systemcomprising cycles of a predefined access pattern for the nodes of thedistributed system to the communication link. Such a time-triggeredarchitecture allows to employ the synchronization method in connectionwith safety-critical electronic systems.

Preferably, the synchronization is carried out in a TDMA system and twoTDMA rounds or cycles are used for measuring deviations before acorrection value is calculated and the clock is corrected.

By only taking particular nodes into account when calculating acorrection value, the fault tolerant behavior can be increased and thememory effort may be reduced.

According to a further preferred embodiment, an amount of a calculatedclock rate correction value is reduced before adjusting the clock basedon the correction value. Such a decreased clock rate correction valueresults in an improved clock synchronization stability and prevents thecluster of nodes from a cluster drift and shifts the whole cluster fromextreme frequency values towards a mean value of all clock frequenciesof the cluster.

Other preferred embodiments of the invention are subject to variousdependent claims.

In the following, embodiments of the invention are described in furtherdetail with reference to the accompanying drawings in which:

FIG. 1 illustrates the general structure of the distributed system in asimplified manner;

FIG. 2 illustrates an example of a typical access scheme;

FIG. 3 gives an example of a simplified block-diagram of a nodeconnected to the communication system;

FIG. 4 gives an example for the structure of a message to be transmittedon the communication system;

FIG. 5 illustrates the measured clock deviation;

FIG. 6 illustrates a clock rate correction;

FIG. 7 illustrates an off-set correction;

FIG. 8 illustrates a combined off-set and clock rate correction;

FIG. 9 shows an illustrated example of clock synchronization accordingto a preferred embodiment of the present invention;

FIG. 10 shows the sequence of measurement and correction phases overtime according to a preferred embodiment of the present invention;

FIG. 11 illustrates the achievable maximum clock off-set when employingoff-set correction;

FIG. 12 illustrates the achievable maximum clock off set when employingrate correction;

FIG. 13 illustrates a maximum clock off-set achievable when employing aclock synchronization according to the present invention;

FIG. 14 illustrates an example of necessary corrections without a ratecorrection reduction; and

FIG. 15 illustrates an example corresponding to that of FIG. 14 with aClock rate correction reduction according to a preferred embodiment ofthe present invention.

FIG. 1 shows a simplified example of a distributed system comprising aplurality of nodes. Each of the nodes is supplied with a clock,comprising a crystal oscillator 2. For sending messages, each node 1 isconnected to a communication link to access the bus for receiving ortransmitting messages. This communication link may further compriseoptional redundant communication channels and is designed to support agross data rate of approximately 10 Mbit/sec.

Each node is not only supplied with its own clock but also withadditional information common to all of the nodes. The commoninformation relates to the communication structure, such a duration of agiven slot or the identity of a sending node. The intended systembehavior is known to all of the nodes and important information can beobtained indirectly from the messages received. For example, explicitacknowledgements need not be sent since a receiving node can determinethat a message is missing immediately after the anticipated arrival timehas passed.

Access to the communication link or bus 3 is determined by atime-division multiple access (TDMA) schema. Every node owns certainslots within the access scheme in which it is allowed to send messageson the bus. A complete cycle during which every node has had access tothe bus once is called a TDMA round. An example for such a singlecommunication cycle is shown in FIG. 2. The communication cycle shown inFIG. 2 comprises two portions, namely a static portion and a dynamicportion. In the static portion, each node only accesses the bus at itsappropriate times. This can be seen in the static TDMA accessed portionwherein each of the six time slots may be accessed by a particular onefor all of the nodes. In the dynamic portion, each node may access thebus according to a predefined scheme providing a collision free accessfor transmitting messages.

After a TDMA round is completed, the same temporal access pattern isrepeated again.

Each communication node may comprise two bus guardians 4 and acorresponding driver 5 to control access of each node to the bus(es) asshown in FIG. 3. All units within a communication node are connected toa single power supply. The bus guardian 4 operates based on the storedinformation on each of the nodes of the distributed system indicating asending time and a period allowed for sending. The bus guardian 4controls access to the communication link which is only allowed at saidpredetermined points of time. The information initially stored in thehost 6 is transferred and stored in the bus guardian during operation.

FIG. 4 gives an example for a message format transmitted on thecommunication link. The message form is the same either for all messageseither transmitted during the static or dynamic portion of a TDMA round.Each message comprises the following fields:

ID: an identifier, 10 bit, range 1 . . . 1023, which defines aslot-position in the static part and a priority of a message in thedynamic part. The smaller the identifier the higher the priority. Eachidentifier is preferably only used once in the system. Each node may useone or a plurality of identifiers.

MUX: Multiplex field, 1 bit, which enables a node to transmit differentmessages with the same ID.

SYNC: synchronization field, 1 bit, indicating whether a message is usedfor clock synchronization.

LEN: length field, 4 bit, which indicate the number of data bytes used(0 . . . 12).

D00 . . . D11: data bytes, 0-12 bytes.

CRC: 16 bit (or 15 bit), used for a cyclic redundancy check.

The clock synchronization algorithm operates by gathering estimates ofthe times of other node's clock to estimate an adjustment of the localclock. Every node knows beforehand at which time certain messages willbe sent. Thus, the difference between the time a message is expected tobe received by a node and the actual arrival time can be used tocalculate a deviation between the sender's and the receiver's clock. Inthis way no special synchronization messages are needed. The measurementwhich is carried over two TDMA rounds is illustrated in FIG. 5. The timeof two nodes or controllers is shown by bold lines in FIG. 5 which aredesignated “controller 1” and “controller 2”. As can be seen, the timeof both controllers slightly differ by each other, shown in a timeoff-set and a time deviation increasing over the time.

In a first cycle, each of both nodes determines the time differencebetween its own time and the time of the other node based on a receivedmessage. The resulting difference also depends on the access pattern ofeach particular node. The same procedure is carried out in a consecutivecycle having the same access pattern. Due to the different clockfrequencies, the time deviations detected by each of the nodes arefurther increased. This additional difference is used to evaluatefrequency differences between both clocks and to adjust the clocks basedon a calculated common time basis.

The results achievable by the clock correction procedures are shown inFIGS. 6 and 7. In FIG. 6, the different clock rates are adjusted inorder to keep an off-set constant and to avoid an increasing clockoff-set between nodes over the time. FIG. 7 illustrates anothercorrection method, namely to correct a detected time off-set. Such anadjustment brings both clocks at the beginning of a cycle closetogether, but both clocks again show a larger difference at the end ofboth cycles.

An improved clock adjustment procedure is shown in FIG. 8. For eachclock adjustment, the clock is corrected with respect to the clock rateand the clock off-set.

The time of the clocks “controller 1” and “controller 2” are indicatedby dashed lines. The off-set corrected clocks are respectively indicatedby dotted lines. The additionally clock rate corrected clocks are shownby bold lines. As a result, both clocks stay dose together and clockdeviation do not increase over time.

The correction values are calculated from measured clock differencesstored in a memory. As described in connection with FIG. 4 the nodeswhich are used for measuring time differences are marked by a specialflag. For the calculation of a global time, each node applies the samealgorithm. In a simple approach, each node calculates the meandifference in order to arrive at a correction value. Preferably, a moresophisticated calculation procedure is employed which is preferably afault-tolerant average algorithm (FTA). This algorithm discards thelargest and smallest value detected and calculates the average of theremaining two values having the largest difference in order to calculatea correction value.

The clock synchronization algorithm that is executed by each of thenodes individually performs for every two consecutive slots the step ofdetermining the difference between expected and observed arrival timesfor the incoming message.

The detected differences are stored in a memory and after detection ofcorresponding difference values during the second cycle, correctionvalues, namely a rate correction and an off-set correction arecalculated.

As shown in FIG. 9, the clock synchronization algorithm comprises threedistinct phases for every two consecutive cycles, namely a measurementphase, a calculation phase, and a correction phase.

The measurement phase splits up into two cycles, namely cycle 1 andcycle 2. For each cycle, the time values for all valid messages with async bit are measured and saved in a first memory portion assigned tothe first cycle and in a second memory portion assigned to the secondcycle. There is no correction applied after the end of the first cycleto the local clock.

During the calculation phase, preferably carried out between cycles 2and 3, a rate correction value and an off-set correction value arecalculated. For the rate correction, differences between the measuredvalues stored in the first and second memory portion are computed. Fromthe computed difference values, two values are selected depending on apredefined rule, which in turn is based on the number k of valid syncmessages. Such a predefined rule and a fault-tolerant midpoint algorithm(FTA/FTM) in general are specified on pages 1-36 in Welch, J. L., Lynch,N.A.: “A New Fault-Tolerant Algorithm for Clock Synchronization”,published in “Information and Computation”, vol. 77, no. 1, April 1998and reference is made to this document. Both selected values are addedand divided by 2. The result is combined with the previous clock ratecorrection value in order to incrementally improve the clock ratecorrection.

For the off-set correction, again two nodes are selected depending onthe number k of valid sync messages. The selection corresponds to theselection procedure of the rate correction and again reference is madeto the above-mentioned document published by Welch and Lynch. The twoselected difference values from the second memory are added and dividedby 2.

Referring to FIG. 9, to the values calculated for different nodes arelisted according to the node number. The first column shows themeasurement results for the first cycle, the second column for thesecond cycle. The third column corresponds to the differences calculatedbetween both measured deviations for the first and second cycle. Thecalculated correction values are shown above these values and areapplied to the local clock as shown on the top of FIG. 9.

The correction phase also splits up into two separate steps, namely arate correction and an off-set correction. The calculated ratecorrection value is applied to the subsequent two cycles, namely cycle 3and cycle 4 to correct the clock frequency. The off-set correction valueis only applied at the beginning of the succeeding cycle, namely cycle3. No further off-set correction will be applied at the beginning ofcycle 4.

This synchronization procedure is repeated for two consecutive cyclesand the cycle numbers may be generalized being cycle (2n-1) and cycle(2n).

The particular 2-cycle scheme for applying;the new synchronizationmethod is shown in detail in FIG. 10.

With respect to the fault-tolerant algorithm used for the calculation ofthe correction values, it is noted that each known fault-tolerantalgorithm may be used, as long as each of the nodes applies the samealgorithm.

The frequency of each of the local clocks may be adjusted by applyingone of a plurality of different of known possibilities, e.g. VCO havinga frequency which may be adjusted based on an applied voltage, circuitswhich control the conversion of clock ticks to counter values byadjusting the number of clock ticks per time unit in order to apply afractional rate correction.

A generalized synchronizing algorithm of a preferred embodiment of thepresent invention operates as follows.

-   -   Round k₀: collect all c(i,j,k₀) in node j, being tagged sync        messages;        -   c(i,j,k) being a difference between observed and expected            time in “micro ticks”, i.e. local micro ticks. When t(i,j,k)            being the physical time for node j expecting the start of            slot i and s(i,j,k) being the physical time observed at node            j for the beginning of slot i, then c(i,j,k) can be defined            as follows:            c(i,j,k)=Int s(i,j,k)−t(i,j,k))[micro ticks].    -   Round (k₀+1): collect all c(i,j,k₀+1) in node j for all tagged        sync messages.    -   At the end of round (k₀+1) the off-set inputs at node j for slot        i are        of(i,j,k ₀+1)=c(i,j,k ₀+1)        and the rate differences are        st(i,j,k ₀+1)=c(i,j,k ₀+1)−c(i,j,k ₀).    -   Generate for each, new round (k₀+2) a new off-set value        o(j,k₀+2) and a new rate correction value d(j,k₀+2) according        to:        o(j,k ₀+2)=FT(of(i,j,k ₀+1))        d(j,k ₀+2)=FT(st(i,j,k ₀+1))+d(j,k ₀)    -   Adjust the clock at the beginning of the next cycle by o(j,k₀+2)    -   Adjust the clock frequency continuously by d(j,k₀+2) for round        (k₀+2) and round (k₀+3).

According to an alternative embodiment, the set of clock rate deviationsand the set of time deviations are determined separately. The clock ratedeviations are determined by comparing two time intervals, an observedtime interval and an expected time interval for two subsequentlyreceived messages form the same node. The observed time interval ismeasured by means of a counter between the actual arrival times of twomessages from the same node, preferably in units of micro ticks. Theexpected time interval is calculated from the expected receiving timesof the messages for the node which are known beforehand and stored ateach node. The difference between both time intervals indicates adeviation due to clock rate differences between both nodes. A clock ratecorrection value is calculated based on the calculated set of clock ratedeviations in the above-described manner.

A single set of time deviations is sufficient for calculating an off-setcorrection value as described above. Preferably, an off-set correctionvalue and a set of time deviations are only calculated once for everytwo cycles in this alternative embodiment.

The particular characteristics of the algorithms of the presentinvention are that the measurement and adjusting intervals do notoverlap and the rate correction is not affected by time faults. Inaddition, this algorithm requires a cycle count in order toappropriately apply the measurement, calculation and adjusting steps.

With respect to the memory effort, not all detected difference valuesneed to be memorized, but only those which are relevant according to theapplied fault-tolerant algorithm.

The reduction of the maximum clock off-set which may be achieved basedon clock synchronization can be seen from FIGS. 11 to 13. FIG. 11illustrates a maximum clock off-set for an applied off-set correctionand FIG. 12 for an applied rate correction. As can be seen from FIG. 12,a rate correction needs not to be applied every cycle aftersynchronization is established. FIG. 13 illustrates the considerableadvantage of the present invention to arrive at a much lower maximumclock off-set. Again, the correction procedure may be applied lessfrequently after a synchronization is established once.

According to a further preferred embodiment, a drift of the global timeto an extreme value may be avoided by applying further measures. Forthis purpose, the clock rate correction value is not applied ascalculated, but the correction amount as calculated is shifted by apredetermined amount. Preferably, the rate correction value is slightlyreduced. This change of the clock rate correction value results in aslightly reduced clock synchronization quality. In contrast, a steadilydrift of the global time to an extreme value is avoided and all nodeswill after a certain time achieve a close proximity to the mean value ofthe clocks to be synchronized.

For this purpose, the clock rate correction value d(j,k₀+2) is replacedby a correction value d(j,k₀+2) +/−x; x being the reduction amount.

In addition, systematic round time errors may be compensated by amendingthe off-set correction value, namely by using an off-set correctionvalue of o(j,k₀+2)−y_(j). y_(j) being a positive value.

FIGS. 14 and 15 show the applied clock rate correction value for eachcycle to establish clock synchronization. In FIG. 14, no correctionvalue amendment is applied. In the given example, all the nodessynchronize to the local time of the upper node (applying no constantcorrection whereas other nodes apply a correction of about −50 or −80).

FIG. 15 shows the result when reducing the clock rate correction valueby reducing the applied clock rate by one micro tick. The global time isshifted to the mean value of all nodes to be synchronized and there isno node not applying any correction.

Summarizing, the present invention provides an improved clocksynchronization algorithm for a distributed system intended for realtime applications by performing at the same time an off-set correctionand a clock read correction at each node of the distributed system.Thus, expensive oscillators can be avoided and synchronization can beestablished faster and with higher precision.

1. A method for synchronizing nodes (1) of a distributed system for realtime applications, the nodes (1) of the distributed system areinterconnected by a communication link (3) and each of the nodes (1)includes a local clock (2) and information indicating when messages areto be received from other nodes (1), each node (1) from at least asubset of all nodes (1) performs the following steps for synchronizingits local clock (2): (a) receiving messages from other nodes (1), (b)determining a set of time deviations between its own local clock (2) andall other nodes (1) of the subset of nodes (1), a time deviation beingdetermined by measuring the difference between an expected receivingtime of a received message and an actual receiving time observed basedon the time of its own local clock (2), (c) determining a set of clockrate deviations between its own local clock (2) and all other nodes (1)of the subset of nodes (1) based on two subsequently received messagesfrom each of the other nodes (1) of the subset, (d) calculating anoff-set correction value based on said determined set of time deviationsand calculating a clock rate correction value based on said set ofdetermined clock rate deviations, and (e) adjusting the local clock (2)based on the calculated off set correction value and said calculatedclock rate correction value.
 2. A method according to claim 1 whereinsaid first determining step (b) determines a first and a second set oftime deviations, and said second determining step (c) calculates saidset of clock rate deviations by calculating differences betweencorresponding time deviations of said first and second set of determinedtime deviations.
 3. A method according to claim 2 wherein saidcalculation step (d) calculates an off-set correction value based onsaid second set of determined time deviations.
 4. A method according toclaim 1 wherein said second determining step (c) determines a clock ratedeviation by measuring the difference between an expected time intervaland an observed time interval, said expected time interval being a timeinterval between expected receiving times of subsequently receivedmessages of a particular node and said observed time interval being atime interval between the actual receiving times of the messagesobserved based on the time of its own local clock (2).
 5. A methodaccording to claim 4 wherein said second determining step (c) determineseach clock rate deviation of said set of clock rate deviations byperforming the steps of (c1) counting a time interval between actualreceiving times of subsequently received messages for a particular node(1) of the subset of nodes (1) based on the time of its own local clock(2), and (c2) calculating a clock rate difference between the countedtime interval for the particular node (1) and an expected time intervalbased on the expected receiving times of the messages for the particularnode (1).
 6. A method according to claim 1 wherein said distributedsystem is a time triggered system.
 7. A method according to claim 1wherein said information included in the node' (1) defines for everynode (1) of the distributedsystem certain time slots in which aparticular node. (1) is allowed to send messages on said communicationlink (3).
 8. A method according to claim 1 wherein said informationincluded in the nodes (1) defines access for every node (1) to saidcommunication link (3) once within a predefined time interval.
 9. Amethod according to claim 8 wherein a time interval having the samepredefined temporal access pattern for the nodes (1) of the distributedsystem to the communication link (3) is continuously repeated.
 10. Amethod according to claim 8 wherein each of the nodes (1) transmits ownmessages when having access to said communication link (3) according tosaid predefined access pattern.
 11. A method according to claim 1wherein said calculating step (d) calculates said clock rate correctionvalue based on two clock rate deviations of said set of determined clockrate deviations according to a first predetermined rule.
 12. A methodaccording to claim 11, wherein said first predetermined rule selects twoclock rate deviations which have the largest difference with respect toeach other.
 13. A method according to claim 11 wherein said firstpredetermined rule excludes clock rate deviations according to a secondpredetermined rule.
 14. A method according to claim 1 wherein saidcalculating step (d) calculates said clock rate correction value byincrementing the clock rate correction value applied during the previousadjusting step with the currently calculated clock rate correctionvalue.
 15. A method according to claim 1 further comprising a step ofchanging the clock rate correction value provided by said calculatingstep (d) according to a third predetermined rule.
 16. A method accordingto claim 15 wherein said third predetermined rule replacing saidcalculated clock rate correction value by a value having a slightlyreduced amount.
 17. A method according to claim 1 wherein said adjustingstep (e) for adjusting the local clock (2) based on the calculated clockrate correction value and the calculated off-set correction value isperformed for both correction values after a predetermined number oftime intervals each of which defining access for every node to saidcommunication link (2) once per time interval.
 18. A computer programcomprising code means adapted to perform the method according toclaim
 1. 19. A synchronizing unit for synchronizing a node (1) in adistributed system for real time applications, the nodes (1) in thedistributed system are interconnected by a communication link (3), thesynchronizing unit comprises: a local clock (2), a memory (6) forstoring information indicating when messages are to be received fromparticular nodes (1), a deviation detector for determining a set of timedeviations between its own local clock (2) and other nodes (1), a timedeviation being determined by measuring the difference between anexpected receiving time of a received message and the receiving timeobserved based on the time of its own local clock (2), and fordetermining a set of clock rate deviations between its own local clock(2) and other nodes (1) based on two subsequently received messages fora node (1), a correction calculation unit for calculating an off-setcorrection value based on said determined set of time deviations and forcalculating a clock rate correction value based on said determined setof clock rate deviations, and an adjusting unit for adjusting the localclock based on the calculated offset correction value and on thecalculated clock rate correction value.
 20. A synchronizing unitaccording to claim 19 wherein said deviation detector being adapted todetermine a first and a second set of time deviations and to determinesaid set of clock rate deviations by calculating differences betweencorresponding time deviations of said first and second set of timedeviations.
 21. A synchronizing unit according to claim 20 wherein saidcorrection calculation unit calculates an off-set correction value basedon said second set of determined time deviations.
 22. A synchronizingunit according to claim 19 wherein said deviation detector being adaptedto determine a clock rate deviation by measuring the difference betweenan expected time interval and an observed time interval, said expectedtime interval being a time interval between expected receiving times ofsubsequently received messages of a particular node and said observedtime interval being a time interval between the actual receiving timesof the messages observed based on the time of its own local clock (2).23. A synchronizing unit according to claim 22 wherein said deviationdetector comprises a counter for counting a time interval between actualreceiving times of subsequently received messages for a particular node(1) based on the time of its own local clock (2).
 24. A synchronizingunit according to claim 19 wherein said memory (6) storing informationdefining for every node (1) of the distributed system a certain temporalaccess pattern allowing a particular node (1) to send messages on saidcommunication link (3).
 25. A synchronizing unit according to claim 19wherein said information included in the nodes (1) defines access forevery node (1) to said communication link (3) once within a predefinedtime interval.
 26. A synchronizing unit according to claim 19 whereineach node further comprises a transmitter for transmitting own messageswhen having access to said communication link (3) according to saidpredefined access pattern.
 27. A synchronizing unit according to claim19 further comprising a deviation memory for storing time deviationsdetermined between the local clock (2) and the clocks (2) of other nodes(1).
 28. A synchronizing unit according to claim 27 wherein said memorybeing adapted to store two sets of time deviations.
 29. A synchronizingunit according to claim 19 further comprising a drift protection meansfor changing the clock rate correction value provided by said correctioncalculating unit and forwarding a changed clock rate correction value tosaid adjusting unit.